mistakenly removed bcrypt import from auth.py, also fixed some notes and comments